protect-secrets

v1.1.2

A secrets firewall for Claude Code. A PreToolUse hook screens every Read, Edit, Write, Bash, and Grep call against tiered patterns (critical/high/strict): sensitive files like .env, SSH keys, AWS/kube/gcloud/docker credentials, and keystores, plus shell commands that expose or exfiltrate them (cat .env, printenv, echo $SECRET_KEY, curl/scp/rsync uploads) and delegation sinks that feed a secrets file or a secret env var to an external model CLI (gemini, codex, llm, sgpt, aichat, openai, mods, fabric) or a model API host; the opt-in strict level also flags any file contents sent that way. Matches are denied, or turned into a prompt via per-level ask mode, with the exact pattern id and reason; .env.example-style templates stay allowed. Safety level is tunable via HOOK_SAFETY_LEVEL, no file edits needed.

Claude Code

By Karan BansalLicense: MIT533 GitHub starsUpdated 2 weeks ago

Directory evidence

Runtimes: Claude Code
Parsed components: 0 skill or MCP entries
Source updated: Oct 4, 2026
Manifest status: Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install protect-secrets for Claude Code

Installs for the current user

claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install protect-secrets@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually

$ git clone https://github.com/karanb192/claude-code-hooks

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/protect-secrets/.

Plugin files

plugins/protect-secrets/

└── .claude-plugin/plugin.json

Plugin manifests1

plugins/protect-secrets/.claude-plugin/plugin.json

{
  "name": "protect-secrets",
  "description": "A secrets firewall for Claude Code. A PreToolUse hook screens every Read, Edit, Write, Bash, and Grep call against tiered patterns (critical/high/strict): sensitive files like .env, SSH keys, AWS/kube/gcloud/docker credentials, and keystores, plus shell commands that expose or exfiltrate them (cat .env, printenv, echo $SECRET_KEY, curl/scp/rsync uploads) and delegation sinks that feed a secrets file or a secret env var to an external model CLI (gemini, codex, llm, sgpt, aichat, openai, mods, fabric) or a model API host; the opt-in strict level also flags any file contents sent that way. Matches are denied, or turned into a prompt via per-level ask mode, with the exact pattern id and reason; .env.example-style templates stay allowed. Safety level is tunable via HOOK_SAFETY_LEVEL, no file edits needed.",
  "version": "1.1.2",
  "author": {
    "name": "Karan Bansal",
    "url": "https://github.com/karanb192"
  },
  "homepage": "https://github.com/karanb192/claude-code-hooks",
  "license": "MIT",
  "keywords": [
    "claude-code",
    "hooks",
    "security",
    "secrets",
    "credentials",
    "guardrails",
    "pretooluse"
  ]
}